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TITLE OF THE INVENTION 

Method, Means, and Computer Program Product for Controlling and/or Restricting Use 
of Telecommunications Connection 

5 BACKGROUND OF THE INVENTION 

Field of the Invention 

The present invention relates to a method for monitoring and/or limiting the use of a 
connection, subject to payment, between IP clients in a packet-switched connection 
10 network. 

The present invention also relates to a system for monitoring and/or limiting the use of a 
connection, subject to payment, between IP clients in a packet-switched connection 
network. 

15 

The present invention also relates to a computer software product for monitoring and/or 
limiting the use of a connection, subject to payment, between IP clients in a packet- 
switched network. 

20 Description of Related Art 

According to the state of the art, in operators' connection networks between IP clients, 
which have genuinely packet-switched connections, data communications connections 
can be provided customer specifically. It is possible to require that the customer's 
identifier and identifier verification data must be received before a customer can be 

25 provided with an individuated network connection. The quality parameters can be 
defined customer specifically. These quality parameters can, for example, define the 
characteristics of the data communications connections relayed over the individuated 
network connection. Such characteristics are, for example, the capacity of the data 
communications connection to be relayed, its delay, delay variation, and the loss and 

30 error ratio in the transmission of the data packets. Data communications connections 
ensuring the quality parameters are charged for on the basis of availability, the quantity 
of data transmitted, capacity, and/or the duration of the connection. 
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A drawback of the state of the art is the limited reliability of billing for Next Generation 
Networks, when the duration of the connection is used to charge for a data 
communications connection that ensures the quality parameters. The data 
5 communications connection between the clients and the signalling link set to monitor the 
use of the data communications connection are typically separate. In IP networks, data 
communications connections, such as IP voice connections, are set on the basis of data 
received over a signalling link, from the direction of the customer. Connection-duration- 
based billing uses data received from the customer's terminal over a signalling link. 

10 Information differing from reality, concerning the use of the data communications 
connection, can be received from the direction of the customer's terminal, for example, 
indicating that use of a set IP session has been terminated, even though in reality use of 
the relevant IP session has not been terminated. When using, for example, the known 
method disclosed in the network publication "Nat and Firewall Scenarios and Solutions 

15 for SIP" by J. Rosenberg et al. s SIPPING WG, June 24, 2002, the connection cannot be 
broken completely, only the granting of quality guarantees can be terminated. 

A further drawback of the state of the art in terms of billing is the fact that, in a packet- 
switched IP network, anyone can form a connection with anyone else, without paying 

20 anything for this connection. This requires that the parties know each other's IP 
addresses. Solutions also exist, in which the operator has defined for or given the clients 
(unreliable clients) specific IP addresses. In this case, the clients are always treated as 
unreliable clients. In such solutions, fraud is easy, because after the closing request 
(BYE) given over the signalling channel, it is entirely possible to continue the 

25 connection, without paying the operator anything for this connection time or event. A 
customer generally uses data communications services in order to gain some benefit, 
which is not directly proportional to the quality of the available connection and/or to the 
amount of data transmitted over the connection. At present, billing for a network 
connection or data communications connection cannot be controlled in such a way as to 

30 be in proportion to the customer benefit. Thus, data communications resources cannot be 
allocated to provide the greatest customer benefit to their clientele, instead the use of 
data communications resources must be restricted using parameters that are of secondary 
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The invention is intended to eliminate the defects of the state of the art disclosed above 
and for this purpose create an entirely new type of method for monitoring and/or 
5 limiting the use of a data communications connection. 

SUMMARY OF THE INVENTION 

The invention is based on setting an operator terminal, such an a SIP system, of the 
signalling channel of the connection state of the client, which is set to control a traffic 
10 limiter, such as a firewall, in the traffic relay system over the data communications 
connection between the source client and the destination client. In addition, the operator 
terminal of the signalling channel can be set to monitor the traffic limiter. 

More specifically, the method according to the invention, for limiting the use of a data 

15 communications connection, is characterized by 

-a message being received from the signalling connection concerning the 
interruption or termination of the session transmitted over the mutual data 
communications connection, and/or state data being received from the billing 
system, over the message connection, concerning an absence in the billing 

20 system or a deficiency in the billing system of the payment required for 

providing the session being transmitted over the mutual data communications 
connection, 

-in response to the message concerning the interruption or termination (107) of 
25 the session, and/or to the state data (304) received from the billing system, at 

least one traffic limiter is instructed (212, 305) to break, interrupt, or close the 
session over the mutual data communications connection, and 

- a two-way signalling link is set (302) between the connection-formation system 
30 (13) and the billing system, through the mediator (14), 

Other aspects of the present invention are directed to a system and a computer program 
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The following advantages are gained with the aid of the invention. Billing for an IP 
connection guaranteeing quality parameters is made more reliable. Such an IP 
5 connection can be, for instance, an IP call guaranteeing the quality parameters. The 
invention makes it possible to substantially restrict a customer from benefiting from 
potentially fraudulent actions. The invention makes it substantially more difficult to 
form, through a connection network, a fraudulent non-paying connection in a packet- 
switched IP network. Possible fraud can be made more difficult by closing the session or 
10 connection between the terminals after a connection-closing (BYE) request made over 
the signalling channel. With the aid of the invention, the use of data communications 
connection in an IP network can be billed for on the basis of customer benefit, and thus 
greater customer benefit can be produced with limited data communications resources. 

15 In addition, with the aid of the invention various additional services subject to payment 
can be provided with greater flexibility. Such services can be, for example, multimedia 
services tailored to meet momentary or long-term needs. 

BRIEF DESCRIPTION OF THE DRAWINGS 
20 In the following, the invention is examined with the aid of examples and with reference 
to the accompanying drawings. 

Figure 1 shows a known method for limiting the use of a data communications 
connection. 

25 

Figure 2 shows one method according to the invention for limiting the use of a data 
communications connection on the basis of the method of Figure 1. 

Figure 3 shows one method according to the invention for limiting the use of a data 
30 communications connection, using as the initiator the payment set for the use of the data 
communications connection. 
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Figure 4 shows one method according to the invention, for increasing customer benefit. 
DETAILED DESCRIPTION OF THE INVENTION 

In the method of Figure 1, the following numbered elements are used. The first SIP 
5 client 1 1 and the second SIP client 12 are customer IP clients of an SIP system. The SIP 
system 13 is an address search and connection-formation system, which is used when 
forming IP connections between SIP customers in the operator's traffic relaying system 
15. Thanks to the SIP system 13, SIP clients need not know the IP addresses of other 
SIP clients to be able to contact them over a data communications connection. At least 

10 one SIP client 12 is addressed in the address-search system in such a way that the 
address-search system is given the IP address of the SIP client 12 in response to a 
desired initiator. SIP customers can be guaranteed a quality of data communications 
connections relayed over the operator's traffic relaying system 15 that need not 
necessarily be guaranteed for data communications relayed over the public Internet. The 

15 mediator 14 is an intermediary system, which the operator has set to control the billing 
for the data communications services that it provides. It is set to limit the billing of the 
data communications connection between the first SIP client 1 1 and the second SIP 
client 12, in response to a predefined connection cut-off message with a specific 
connection identifier, received from the direction, such as the address, of the first 1 1 

20 and/or the second SIP client 12. 

The operator's traffic relaying system 15 is an IP-addressed system, set to be ready to 
provide a relay service subject to payment, to which is it advantageous to direct data 
communications, which have set or desired quality requirements. In addition to 

25 contacting terminal points, the operator's traffic relaying system 15 may also have the 
role of guaranteeing the quality of the data communications connection between them. 
Billing for this can be based on, for example, the network, time, event, and volume. The 
operator's traffic relaying system 15 includes a data-communications network set to be 
ready to relay, for a payment, IP-addressed data communications and possibly also 

30 related ancillary services. The firewall 16 is a traffic limiter, set to filter undesired traffic 
from outside the operator's traffic relaying system 15, and through which the operator's 
traffic relaying system 15 is set to open, or to keep open at least one data 
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communications connection between a first SIP client 11 and a second SIP client 12. 
The SIP signalling takes place over a link that is separate from the data communications 
connection between the clients. When the SIP system 13 is used to analyse the state of 
this data communications connection, it is necessary to trust the messages sent by the 
clients. 

In the known method for billing for the use of a data communications connection, the 
following stages are performed. Stages 101 - 104 are performed in order to set the 
operator's system to be ready to provide an IP call or a multimedia connection, 

101) The means of the SIP system 13 for monitoring and billing for sessions are set 
for the mutual signalling link with the SIP client 1 1, outside of the SIP clients' 
mutual data communications connection. 

102) The SIP client connections together with the signalling link are set to be 
genuinely packet switched, so that separate signalling links and circuit-switched 
subscriber networks that generally exploit data transmission capacity with a low 
loading, or other auxiliary networks, will no longer be needed. 

103) At least one firewall 16 or other traffic limiter, based on the properties of the 
header fields of the packets being transmitted and possibly also on ports, is set 
for the mutual data communications connection of the SIP clients. The traffic 
limiter is a network element, which is set to exclude undesired data traffic over 
the packet network connection. The traffic limiter can also be set to limit the 
transmission speed of desired data traffic, in order to distribute limited data 
traffic resources in an appropriate manner. 

104) A message connection is set for the SIP system 13 to the billing system, so that 
sessions can be monitored and billed for and so that the billing can be controlled 
and monitored. 

Stages 105 - 110 of the method are performed, in order to provide an IP call or 
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105) A mutual data communications connection is set for at least two clients, through 
the operator's connection network. 

106) At least one firewall 16 and/or other traffic limiter in the operator's traffic 
relaying system 15 is instructed to permit the passage of at least one session 
between the first 1 1 and the second SIP client 12* 

107) Data on the state of a session between the first SIP client 11 and the second SIP 
client 12, such as a c bye' message notifying of the termination of the session, is 
received over the SIP system 13 from the first 1 1 or the second SIP client 12. 

108) In response to the received state data, the mediator 14 is instructed to limit the 
billing being monitored session-specifically. 

109) At least one session is transmitted over the mutual data communications 
connection, and is then individuated, and 

110) The billing to be charged for the data communications connection and being 
monitored session-specifically is controlled over the message connection, and/or 
the billing being monitored session-specifically is defined in the billing system. 
When defining the billing, the billing principles and/or the billing of the session 
can be set. When controlling the billing, a message or messages are sent to define 
the billing. 

It is preferable to use the method according to Figure 2, if payment for the session is 
made afterwards (post-paid). In the method of Figure 2, stages 201 - 206, which are the 
same as stages 101 - 106 of method 1, are performed. In the method according to the 
invention, stages 207 - 210, which correspond to stages 107 - 110, can also be 
performed. In the method, the following stages are also performed. Stages 211 - 216 are 
performed in order to prevent the fraudulent use of data communications resources 
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without payment and to bill for the use of the data communications resources, 

211) In response to a connection cut-off message received from the first 11 or the 
second SIP client 12, or to a message for interrupting or terminating the mutual 
5 data communications connection, the firewall 16 or other traffic limiter is 

instructed over the SIP system 13 to cut off, shut* interrupt, or prevent at least 
one session or data communications in its entirety between the first 1 1 and the 
second SIP client 12. 

10 212) In response to a connection cut-off message or message for the interruption or 
termination of the mutual data communications connection, a message is directed 
over the SIP system 13 to the mediator 14, in order to monitor and/or to limit the 
billing. 

15 In the method of Figure 3 too, the elements of Figure 1 are used to control the firewall. It 
is preferable to perform this method, if payment for the session is made beforehand (pre- 
paid). Stage 301 of the method of Figure 3 is performed in order to monitor the 
existence of the payment required for the data communications connection between the 
first 1 1 and the second SIP client 12. 

20 

301) A state that will indicate an insufficient payment for the continuation of the 
session or data communications connection, and which can thus an initiator to 
the traffic-relaying system 15 to interrupt or terminate at least one mutual session 
or data communications connection between a first 11 and a second 12 SIP 

25 client, is set in the mediator 14 or the billing system controlled by it. 

Stages 302 - 303 are performed in order to limit the fraudulent use without payment of 
data communications resources. 

30 

302) A reliable two-way signalling link is set between the connection-formation 
system and the billing system, through the mediator 14. 
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303) The mediator 14 is set to provide initiations for instructing the traffic-relaying 
system 15 to interrupt or terminate at least one mutual session between one first 
1 1 and a second SIP client 12* 

Stages 304 - 305 are performed on the basis of the billing system. If the prepaid payment 
allocated to the client or session has been used up and/or the credit limit, maximum 
charge and/or other monitoring criterion based on the quantity, quality, and/or value of 
the data communications, allocated to the session, is fulfilled, the relaying of data 
communications can be terminated in real time, or its properties can be limited. 
Connections can also be correspondingly opened in real time and flexibly. 

304) A connection cut-off message and/or state data is received from the mediator 14 
concerning an absence, in the billing system, or an insufficiency, in the billing 
system, of the payment required for providing a session relayed over a mutual 
data communications connection. 

305) In response to the connection cut-off message received from the mediator 14 
and/or to the state data, the firewall 16 is instructed by the SIP system 13 to close 
the data communications connection or session according to the connection cut- 
off message and/or the state data, between the first SIP customer 1 1 and the 
second SIP customer 12, or more generally in response to a connection cut-off 
message and/or state data received from the billing system, to use the means for 
monitoring and billing of the sessions to instruct at least one traffic limiter to cut 
off or interrupt the mutual data communications connection, or the session over 
the mutual data communications connection. 

In stage 305, instead of or along with the SIP system, the mediator 14 can be set to 
directly control the firewall 16 or possibly the traffic-relaying system 15 controlling the 
firewall. 
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The method of Figure 4 for increasing customer benefit can also be implemented using 
the elements disclosed in the previous figures. In the method, the stages of the method 
according to Figure 2 are performed and/or the stages of the method according to Figure 
3. In addition to these, stages 401 - 404 of the method are performed. 

Stages 401 - 402 of the method are performed in order to permit the use of and to bill for 
value-added services, such as multimedia services. 

401) A tailored right to use the operator's traffic-relaying system 15 is set, in the 
billing system, for the first SIP customer 1 1. 

402) A value-added service initiation message concerning the first SIP customer 1 1 is 
received (402a) over the SIP system 13 and is forwarded (402b) to the mediator 
14, or more generally a data-communications-based service initiation message is 
received over the connection-forming system, concerning at least one first client 
and one second client, and is forwarded to the billing system. 

Stages 403 - 404 of the method are performed in order to set the operator's traffic- 
relaying system 15 dynamically to the state required for providing a value-added 
service. 

403) A data-communications-based service use message is received while a message 
confirming the stimulus required for the use of the service is received from the 
mediator 14. 

404) In response to the message, the operator's traffic-relaying system 1 5 is instructed 
to set the quality of the data communications connection between the first SIP 
customer 11 and the second SIP customer 12 to the level required by the value- 
added service according to the use message, or more generally, in response to the 
message confirming the initiation to instruct the operator's traffic-relaying 
system to control the formation of a mutual data communications connection 
between at least one first client and at least one second client, and/or to instruct 
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the properties of the mutual data communications connection to be those 
required by a data-communications-based service, or to be advantageous in terms 
of a data-communications-based service. 



5 The four methods disclosed above can be combined in full or in part, and thus new 
forms of method according to the invention for limiting the use of a data 
communications connection can be created. The precise embodiment to be employed is 
best selected on the basis of what is important in terms of the connection network, the 
billing system, and/or the clients, 

10 

Embodiments, differing from those disclosed above, can also be envisaged within the 
scope of the invention. The area of application of the invention is the provision of a data 
communications connection, subject to payment, targeted on IP addresses. The solution 
according to the invention is not tied to what is transported on top of this data 

15 communications connection. However, the invention is preferably applied to the 
transmission of IP voice and possibly related multimedia. Other types of traffic limiter 
can be used in place of the firewall 16. To control the transmission of IP voice or 
multimedia, other suitable protocols may be used for this purpose, either instead of SIP 
or in addition to it The coverage of the firewall may be limited by its operator 

20 dependence. In order to achieve the desired prevention of traffic in the operator's traffic- 
relaying system 15, or to remove the desired prevention of traffic from the operator's 
traffic-relaying system 15, a series or a combination of firewalls and/or other traffic 
limiters may also be used. In such a case, it will of course be necessary, when opening 
connections, to take into account the fact that the entire chain must be opened. The SIP 

25 system 13 can include a PROXY server for use in making the necessary openings in the 
firewalls. It can be set to control the collection and transmission of billing data and the 
limitation and control of traffic, and/or the prevention of traffic. It is possible to use a 
session-specific identifier and set the traffic prevention on its basis. IP addresses, or 
other components of the header field of an IP packet, can be used as an additional basis 

30 for traffic limitation. 



According to the SIP protocol, address modification can take place over the connection 
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between the clients in the operator's traffic-relaying system 15, using a separate NAT 
server, and/or in connection with the SIP system 13. In the method according to the 
invention, the SIP clients can also be in multi-link connections, which when necessary 
are controlled, limited, and/or billed for. The quality of the data communications 
5 connection and/or session being provided can, if necessary, be improved or limited by 
activating and deactivating the service-quality field in the header fields of the IP packets* 
The SIP system 13 and the traffic limiters, such as the firewalls 16, can be set to 
communicate mutually, for example, by creating a protocol that takes into account the 
objectives set for data traffic between them. The protocol can be used to transmit the 
10 parameters of the connection, such as, for instance, the amount of data transmitted 
during the connection. It is possible to use, for example, the MIDCOM protocol to 
reliably open and close the necessary connections between the SIP customers 1 1 and 12. 

The following abbreviations are used in this application 

15 

IP, Internet Protocol, NAT, Network Address Translation, NGN, Next Generation 
Networks, and SIP, Session Initiation Protocol. 

When the invention is applied in practice, it is preferable to allow for the following 
20 factors: 

The clients according to the embodiments are preferably unreliable clients, which 
communicate mutually and the communication between which, such as an image, sound, 
data, data stream, or some combination of these, travels over a route that is essentially 

25 different to that of the signalling between them. A data communications connection may 
have simultaneously more than two clients. The operator's traffic-relaying system 15 
includes a data communications network, which has purely packet-switched customer 
interfaces with the clients according to the embodiments. The operator's traffic-relaying 
system 15 should have at least one port, through which the communication between the 

30 clients is arranged. The port must have a control system, such as the SIP system 13, 
which monitors, registers, and controls the traffic travelling through the port. The 
control system must be in signalling contact with at least one billing control unit, the 
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mediator 14, which forms or collects at least one billing record, or edits at least one 
billing record for at least one client participating in the session. 

The method can be applied in such a way that data traffic cannot pass the port of the 
5 traffic limiter, if the control system has not received a command to permit this. Thus, the 
control system is used to monitor the signalling channel, until the connection-formation 
command 4 invite', or some other even in the signalling channel affirms that a connection 
should be formed between the clients. In response to the command given by the control 
system, a data communications connection is opened between the clients, through at 

10 least one port of the traffic limiter. Next, the control system is used to monitor the 
signalling channel, until the termination command 'bye', or some other event in the 
signalling channel affirms that the mutual communication of the clients of the session 
terminates, after which a command given by the control system is used to close the 
connections travelling through the port between the clients. Communication may also 

15 terminate without a separate signal In any event, the port can be set to signal to the 
control system, if there is a break in the data communications connection arranged 
through the port, thus permitting the connection to be used as a basis for monitoring 
billing. This permits the formation of a billing record, according to the desired billing 
model, for the connection. 

20 

The monitoring to the connection-formation system can also be performed using the 
'time-out' function of the SIP system 13. The operator can then set an interval at which 
the SIP system 13 checks whether the connection between the SIP clients 1 1 and 12 is in 
use. This gives the connection a rough termination time, which can be used as a basis for 
25 billing. The arrangement can be implemented, for example, with the aid of a proxy 
server. 

The method can be further used to obtain additional benefit, using the fact that the 
billing model is connection-duration-based, otherwise time-based, volume-based, event- 
30 based, and/or customer-benefit-based. The control system can be set to record the 
approximate, estimated, or actual commencement and termination times of the data 
communications connection between the clients, for billing. The control system may be 
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set to record the amount of data allowed through the port on the data communications 
connection being examined, for billing. The control system can be set to record the 
communication between the clients, on the basis of the commands they give and/or the 
billing tickets coming from the network, for billing. 

5 

Billing can be set to be collected either beforehand (pre-paid) or afterwards by invoice 
(post-paid). The billing unit and the control unit can be set to communicate in the 
manner required by the selected form of billing (pre-paid, post-paid). Both manners can 
also be applied in parallel. 

10 

It is preferable to set the communication between the clients to take place, for example, 
using the RTP or H.323 protocol. It is preferable to perform the monitoring and 
signalling, for example, using the MIDCOM, FCP (Firewall Control Proxy), or a similar 
protocol. The programs used by customers, such as Microsoft Messenger, support the 
1 5 TCP, UDP, and TLS protocols, among others. 

The connection-formation system, such as the SIP system, can be set to open and/or 
close data communications connections and/or sessions between the clients 11 and 12, 
by means of operations according to the MIDCOM protocol. 

20 

It is preferable to use the SIP protocol on the signalling connections of the clients, while 
it is preferable for the clients to use a 'bye' message, according to the SIP, for forming, 
breaking, and interrupting the data communications connection. The packet-switched 
data communications connection is preferably an IP connection, more suitably a voice or 
25 multimedia connection. In the method, the source and target of the packets can be 
identified with the aid of the addresses, such as an IP address and port address, 
contained in their header fields. The identifier 'Call ID* of the session being examined 
can also be used for identification. 

30 In place of, or in addition to the SIP system 13, it is possible to use other means over a 
signalling connection routed differently to the mutual data communications connection 
of the clients, for monitoring and billing for the sessions. 
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Reliable two-way intercommunication can be set between the SIP server 13 and the 
mediator 14, in which case data on the payment relating to the clients' mutual data 
communications connection will be obtained reliably from the mediator 14 and reliable 
5 data on the session will be obtained for the mediator 14, in order to monitor session 
billing session-specifically. 

In the method according to the invention, signalling to and from the clients can be 
recorded. It is possible to break the data communications connection or limit the data 
10 communications connection on the basis of the recorded signalling. On this basis, it is 
also possible to close, interrupt, break, limit, and/or prevent individual sessions relayed 
over the data communications connection. 

In this case, the term addressing refers to the destination's current IP address being tied 
15 to a natural-language identifier of the destination being sought, or to another more 
generally valid identifier of the IP address. 

The breaking, interrupting, and/or closing of a session refers to all data transmission 
being terminated in the session, or the termination in the session of the transmission of 
20 data that is central or essential in terms of the operation of the session. 

The invention can also be applied to combination pricing. This, for example, time and 
quantity-based pricing, in which the customer is charged, for example € 0,50/minute for 
a maximum rate of a megabit per minute and, in addition to the megabit per minute rate, 
25 € 0,03/kilobyte of data transmitted. In connection with this, the operator terminal of the 
signalling channel, such as the SIP system 13, forms a database, log, or ticket, which 
preferably includes the session identifier, 'CalllD'; the address or identifier of the first 
SIP client, the 'from' field; the address or identifier of the second SIP client 12, the 'to' 
field; the time of the start of the session, 'invite'; and the time of termination, 'bye*. 

30 

Alternatively, the database, log, or ticket can include the approximate or precise 
'detected time-out' moment of the session and the IP address of the first SIP client 11. 
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The session identifier 'CalllET can be generated by the first SIP unreliable client 1 1, or 
the SIP system 13. If it is generated by the first SIP client 1 1, the system can then be set 
to monitor, for example with the aid of timestamps, whether the first SIP client 11 
begins to generate several session identifiers CalllDs. 



